"Un"format

[transcendental]

Hello everyone,
I found a program that claims to "unformat" the hard disk. How does that work? I know that when the hard disk is formatted, the hard disk is overwritten with zeroes. So, how can data be recovered?

Or...

Is it all just a trick to raise your hopes up and make you think you can actually unformat the disk?

[Fruss Tray Ted]

Formatting does NOT write zeros to the disk. It formats the drive as Fat32 (9x and NT) or NTFS (NT systems only). Drive manufacturer's diagnostic tools and specialty softwares do write zeros to clean stubborn virii or destroy sensitive data before tossing or selling the drive or pc.

If you have the drive formatted for use with Windows, you cannot install any of the Linux varieties of os'es. Therefore the software you have chanced upon would be useful if you wanted to switch from Windoze to Linux. It will revert the drive back to a condition commonly called 'raw' format.

[Paul Komski]

I presume that "unformatting" is required for data recovery purposes after a partition has been formatted by accident but not overwritten with data.

Such data recovery could work, for example, by reading the directory structure and rebuilding the FATs based on the position and size of unfragmented files found by scanning the whole partition. Some fragmented files might also be capable of being re-referenced depending on the whole state of the partition and the complexity of the algorithms that the software uses.

Individual files can, for example, be recovered in such situations by utilities such as GetDataBack - so it is just one step further (having identified the file on the partition) to rebuild the FAT to match that file's data.

Deleting and recreating a partition using fdisk can write a certain amount of zeros to the data area but simply formatting, as FTT points out, doesnt zero the data area of a drive but does reset the FATs to "zeros". A FAT entry with zeros just indicates that the relevant cluster on the drive is free to be used.

[Sylvander]

Would I be correct,
in thinking that formatting only involves marking the "File Allocation Table" [e.g. FAT32] entries [for example] as "available for use" [like deleting does with files]?
Or does it delete the entries?
That it leaves the data on the drive untouched, and therefore "un-formatting" would involve re-constructing the "File Allocation Table"?
That the FAT is like an index that specifies where everything is located on the HDD, therefore once the FAT is reconstructed, the HDD is back the way it was before being formatted?

[Paul Komski]

Each FAT 32 entry is 4 bytes in size and the FATs are just a table or grid representing spacially all the data clusters on that partition.

Leaving aside bad sectors and the name for the partition's label, any value greater than or equal to 0XFFFFFFF8 indicates that the referenced cluster is the last one belonging to that file. If the value is 0x00000000 then that cluster is free to be used. Other values indicate where the next cluster belonging to that file will be found.

When a file is deleted the data remains where it is in the data area. The FileName (in its directory, where it stored along with its attributes) is simply marked as Deleted with a "flag". That flag is the one-byte value 0xE5 at the start of each 32-byte directory entry. At the same time all the bytes that had been allocated to the file in the FATs are zeroed thus indicating that the previously allocated space is now free for re-use.

There is of course also a quick and a full format. The former is a quick way of deleting all the files on the partition. The latter does the same but then runs through the partition looking for bad sectors and also rewriting the metadata at the start of the drive. Data can be retrieved after both of these "high-level" formats. A true factory or low level format renders data effectively non-retrievable.

[transcendental]

Well...
I tested the program on my computer. (what the heck, the hard drive is failing anyways.)
After I ran it, I noticed that the recovered data was put in directories with names like DIR0001,DIR0002,DIR0003, etc...
If I want to run windows from the recovered data. (which I do), what do I do?
The drive won't let me boot.

[Paul Komski]

This is the first time you have indicated you were trying to actually recover a situation. Fuller information about what happened, what was on the drive, which operating system, which software was used for "unformatting", etc, etc, would be of fundamental help.

Even so I would be most surprised if the whole drive can be put back into a bootable state. Recovery software seldom can do that - particularly from a formatted partition - but can often be pretty successful in retrieving one's data.

[davidkahn]

Your partition maybe has some problem. If you want to recover your data, I suggest you use DataRecoveryWizard. [Link removed by Mods]

[Paul Komski]

davidkahn - if you and Alfred (from the same address by some strange "coincidence") just want to come here and advertise (without prior approval from the owner) then your links will be removed and you will be banned.

[Fruss Tray Ted]

$129.00????????

Gonna take a lot of advertizing to make even ONE sale at that price around here...

Transcendental,
GetDataBack is the preferred around here and I can attest it has worked well for me in the past, more than once. I've tried a few other freebies but GDB gave the best results IMO. I had accidentally deleted files on a pen drive and another time on a harddrive :o Seems I am my own worst enemy... :eek: I got over an 80% recovery of files if not more like 95%.

But you are not going to get a bootable drive again. Esp, if it has bad sectors near the beginning of the drive. Those DIR0001,DIR0002,DIR0003, you can double click on the view them and save manually, one at a time with the free version and possible clusters (or folders) with a paid version.

You need a new drive to install your os onto and then put the recovered files onto that.